CVE detail
CVE-2026-28367
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 16.1 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
4 source links · newest first
- https://bugzilla.redhat.com/show_bug.cgi?id=2443260bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMar 27, 2026, 5:16 PM - https://access.redhat.com/security/cve/CVE-2026-28367access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 27, 2026, 5:16 PM - https://access.redhat.com/errata/RHSA-2026:25126access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 27, 2026, 5:16 PM - https://access.redhat.com/errata/RHSA-2026:25125access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMar 27, 2026, 5:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-28369CVSS 8.7 · High
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping…
- CVE-2026-28368CVSS 8.7 · High
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to…
- CVE-2025-12543CVSS 9.6 · Critical
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host heade…
- CVE-2025-9784CVSS 7.5 · High
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset"…
- CVE-2024-7885CVSS 7.5 · High
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyPro…
- CVE-2023-1108CVSS 7.5 · High
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.